A misconfiguration in Keycloak’s role mapping logic allows an administrator who has the manage‑clients permission to inadvertently have the same level of access as those with manage‑permissions. This flaw gives the privileged user the ability to modify roles, change user permissions, and execute other administrative functions within the realm, effectively elevating their privileges. Identified as CWE‑266, the vulnerability represents an elevation of privilege weakness that can be used to subvert the security model of the realm without requiring additional exploitation steps.

The flaw impacts several Red Hat‑sponsored products that include Keycloak 26.4 (also specifically 26.4.11), Red Hat JBoss Enterprise Application Platform 8, the JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. These builds run on Red Hat Enterprise Linux 9 or earlier releases; any installation of the listed versions hosts the vulnerable role‑mapping logic unless the relevant security updates are applied.

The CVSS score of 6.5 indicates a medium‑to‑high severity vulnerability. EPSS is less than 1 %, reflecting a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalogue. The attack requires an existing realm‑level administrator who has been granted the manage‑clients permission; no external network or service exploitation is documented, so the threat is limited to environments where such permissions are misconfigured. If exploited, the attacker gains the ability to remodel the realm’s permission structure, potentially taking over user accounts and adjusting security settings.